List of all URLs in docx file

Question

Hi,

I am trying to analyze various .docx files (OOXML) for purposes of finding maliciousness in them. Now i know that one way is to hide malicious URLs. Now, due to the file structure of these files, they contain a lot of links that look like this:
http://schemas.microsoft.com/office/word/2012/wordml"

http://schemas.openxmlformats.org/markup-compatibility/2006"

http://schemas.openxmlformats.org/officeDocument/2006/relationships"

etc..

Could you provide an exhaustive list of legitimate URLs found in docx files. For example, I know that URLs starting with "schemas.microsoft.com" are legitimate.

Please provide me with a list of legitimate URLs found in docx files.

Thanks,

Parth Gupta

Answer 1

Hi @Parth Gupta ,

I can't provide an exhaustive list of valid URIs, but if you look through the the Office Standard you can find a collection of valid URIs. @John Korchok is correct, however, those are URI namespaces used by the file format and should not pose a risk, so either way you can rule that out.

Best Regards,

Michael Bowen

Escalation Engineer - Microsoft Open Specifications

Answer 2

Those are URIs, not URLs. Here an article explaining the difference:

https://en.wikipedia.org/wiki/Uniform_Resource_Identifier

URIs can also function as URLs, but most of the ones in an Office file do not.